Alaska Prenatal Care Records Privacy Laws: A Compliance Checklist

Protecting prenatal records in Alaska means matching each request or disclosure to the right privacy rule. Use this checklist to review minor-consent decisions, birth center recordkeeping, written authorizations, Health Information Exchange (HIE) practices, and Department of Health requests.

Verify Minor Consent and Parental Access Rules

Alaska law allows a minor to consent to diagnosis, prevention, or treatment of pregnancy. That consent does not, by itself, answer every question about parental access to the resulting records. For HIPAA-covered providers, a parent is generally a minor’s personal representative, but HIPAA recognizes exceptions when state law allows the minor to consent to a service and the minor does so.

• Record the legal basis for the minor’s consent and identify which services the minor consented to independently.
• For each parental request, verify the parent’s authority and assess whether the request concerns care the minor consented to. Do not assume that parental status alone resolves access to those records.
• Apply applicable state law and HIPAA’s personal-representative rules before granting or denying access. If the law does not settle parental access, a licensed professional may need to make the decision using professional judgment.
• Route safety concerns, custody questions, or requests involving multiple types of care for privacy or legal review before disclosure.

Protect Birth Center Prenatal Records

Alaska’s birth center rules require records to be maintained in a system that protects confidentiality, supports secure storage and retrieval, and prevents loss or unauthorized access. They also require birth centers to safeguard protected health information against uses or disclosures that are not required or permitted by HIPAA.

• Restrict record access to staff and practitioners with authorized roles, and use safeguards for both electronic and paper files.
• Maintain complete records that support continuity of care, including relevant prenatal assessments, consultations, referrals, and transfers.
• Apply the birth center’s birth center medical record retention schedule: retain care and treatment records for at least seven years after discharge. For a client under 19, retain them until at least two years after the client turns 19 or seven years after discharge, whichever is longer.
• Pause routine destruction when a legal hold, investigation, or other applicable retention requirement calls for longer preservation.

Obtain Written Consent for Record Disclosures

For HIPAA-covered entities, written authorization is generally required when a disclosure is not otherwise permitted or required by the HIPAA Privacy Rule. But written authorization is not required for every disclosure: HIPAA permits certain disclosures for treatment, payment, health care operations, and specified public-interest purposes.

• Before releasing individually identifiable health information, document the purpose and determine whether a HIPAA permission or legal requirement applies.
• When authorization is required, use a valid written authorization that identifies the information, recipient, purpose, expiration, and the patient’s signature or that of an appropriately authorized representative.
• Verify that an authorized representative has authority for the specific health care matter. A representative’s authority should not be assumed to cover care the minor consented to independently.
• Keep a copy of the authorization and record what was disclosed, to whom, when, and under what authority.

The Alaska Personal Information Protection Act addresses protections such as breach notification and disposal of records containing personal information; it does not replace the HIPAA Privacy Rule or the rules governing access to clinical records.

Apply Health Information Exchange Privacy Requirements

Alaska’s HIE confidentiality and security requirements were amended effective June 19, 2026. The law requires privacy and security standards, including a traceable electronic audit system, and limits HIE disclosures to specified purposes such as treatment, payment, limited health care operations, public health activities, and disclosures authorized by the individual. It also provides for patient opt-out procedures and access to an audit report upon request.

• Train staff to distinguish HIE access from a direct disclosure by the birth center; apply the rules and permissions relevant to each route.
• Confirm the current process for patients to opt out, authorize distribution when additional authorization is required, and request an audit report.
• Limit access to users with an authorized purpose and review audit trails for inappropriate access or disclosure.
• Do not treat an HIE connection as blanket permission to disclose every record. Apply HIPAA and any more protective state requirements to sensitive prenatal information.

Process Department of Health Record Requests

Patients and authorized representatives requesting protected health information from the Alaska Department of Health must submit a written request using the Department’s Request for Access to PHI form. Identify the records sought and provide the information needed to verify the patient’s identity and, when applicable, the representative’s authority.

• Route the request to the Department unit that maintains the records; the Section of Epidemiology publishes its own access instructions and form.
• The Department’s form states a response time of 30 days for information maintained on-site and 60 days for information maintained off-site. The Section of Epidemiology’s webpage describes its access-request response period as 30 days. Check the applicable unit’s instructions and any notice of extension or denial.
• Distinguish a patient’s access request from a request for summary data or a limited data set, which follows a separate data-request process.
• Document receipt, identity verification, the records searched, the response, and any applicable denial or extension notice.

Document Authorized Disclosures

A reliable disclosure record helps show why access was allowed and whether the release stayed within its approved scope. The HIPAA minimum-necessary standard generally calls for reasonable limits on the information used, disclosed, or requested, subject to exceptions such as disclosures for treatment and disclosures to the individual.

• Log the requester, recipient, purpose, legal basis, date, records disclosed, and staff member who approved the release.
• Retain the applicable authorization, proof of representative authority, court order, or other supporting documentation.
• Record how staff handled any uncertainty, minor-consent issue, denial, or escalation.
• Use the logs to review access controls, investigate suspected privacy incidents, and meet applicable breach-response obligations.

In practice, a compliant process verifies who may access a record, preserves birth center records for the required period, and documents each disclosure under the applicable HIPAA, Alaska, and HIE rules.

FAQs

Can parents access records for pregnancy care a minor consented to?

Not automatically. Alaska law allows a minor to consent to diagnosis, prevention, or treatment of pregnancy, and HIPAA’s rules can limit a parent’s personal-representative status for care the minor consented to independently. Assess the particular service, applicable state law, and any other source of parental authority before releasing the records.

When must birth centers make prenatal records available?

Alaska birth center rules require records to be readily available upon request to the physician, consulting physician, midwife, or Department. Upon the client’s written request, records must be made available to other practitioners. Patients also have a right under Alaska law to inspect and copy records pertaining to their care, subject to applicable privacy rules.

When is written consent required to disclose prenatal records?

For a HIPAA-covered entity, written authorization is generally needed when no HIPAA permission or legal requirement supports the disclosure. Some disclosures, including certain disclosures for treatment, payment, or health care operations, may be made without written authorization. Check for additional state or HIE requirements before releasing records.

How can patients request protected health information from the Alaska Department of Health?

Submit a written request using the Department’s Request for Access to PHI form. Describe the information requested and include the details needed to verify identity and any representative authority. Follow the instructions for the Department unit that holds the records; the Section of Epidemiology has its own published access-request process.